Integrate Microsoft Azure with Red Canary

Download the Red Canary Bicep file and upload it to your Azure Cloud Shell.

1. From your Red Canary homepage, click Microsoft Azure.

2. Enter a name for your new Microsoft Azure integration.

3. Click Red Canary Bicep File to download the required file. You’ll use this in a later step.

   

4. Copy and then save the command below. You’ll use this in a later step.

   Note: For the <TenantId> below, enter your Azure Tenant ID.

   az deployment mg create --name 'RCLogIngestPolicy' \
     --location eastus \
     --template-file RedCanary.bicep \
     --management-group-id <TenantId>

   
   Microsoft Azure
   

5. From your Microsoft Azure homepage, click Cloud Shell.

   

6. From the Cloud Shell dropdown, select Bash.

   

7. Click Upload File.

   

8. Click Upload.

9. Select the Red Canary Bicep File you downloaded in Step 1.4.

10. From the Cloud Shell command, paste and then run the command from Step 1.5.
    
    Red Canary
    

11. Select I’ve deployed the Bicep file.

    

12. Copy the entire command below and then save the command. You’ll use this in a later step.

    az account list --query "[].id" \
      --out tsv | xargs -I {} -P 10 az policy remediation \
      create --name RCLogConfigurationAccessDeploy --policy-assignment RCLogConfigurationAccess \
      --resource-discovery-mode ReEvaluateCompliance --subscription "{}"
    
    az account list --query "[].id" \
      --out tsv | xargs -I {} -P 10 az policy remediation \
      create --name RCAutomationRgDeploy --policy-assignment RCAutomationRg \
      --resource-discovery-mode ReEvaluateCompliance --subscription "{}"

    

    
    Microsoft Azure
    

13. From the Cloud Shell command, paste and then run the entire command from the step above.

    Note: This command runs a remediation to apply the diagnostic setting policies to all existing subscriptions.

    
    Red Canary
    

14. Select I’ve Connected my existing subscriptions.

    

15. Click Next.

For Red Canary to start receiving your telemetry, you must send your data from your environment to an Azure log analytics workspace.

Note: If you already have an Azure log analytics workspace ingesting logs, including ADFSSignInLogs, AuditLogs, ManagedIdentitySignInLogs, ServicePrincipalRiskEvents, ServicePrincipalSignInLogs, SignInLogs, and UserRiskEvents, select I already have a Log Analytics workspace set up and continue on to Step 2.20.

1. Select I need to set up a Log Analytics workspace.

   

   
   Microsoft Azure
   

2. Login to Microsoft Azure using a Global Admin account for the tenant that you want to integrate with Red Canary.

3. In the search bar, type and then select Resource groups.

   

4. Click +Create.

5. From the Subscription dropdown, select the subscription which you would like to house your Azure Log Analytics Workspace.

6. Enter a Resource Group name.

   (Example: Red_Canary_Resources)

7. From the Region dropdown, select your local region.

8. Click Next: Tags >.

9. Click Next: Review + create >.

10. Click Create

11. In the search bar, type and then select Log Analytics workspaces.

12. Click +Create.

13. From the Subscription dropdown, select the subscription you want associated with this workspace.

14. From the Resource group dropdown, select the Resource group created in Step 2.6.

15. Enter a name for the Instance details.

    (Example: Red_Canary_Log_Analytic_workspace)

16. From the Region dropdown, select your local region.

17. Click Next: Tags >.

18. Click Next: Review + create >.

19. Click Create.

    Red Canary
    

20. Select I’ve completed creating the Log Analytics workspace.

    

    Note: If you already have a Log Analytics workspace to collect Entra ID logs, select I already have a Log Analytics workspace setup to collect Entra ID logs, and then click Next to continue on with Step 3.

21. Select I need to configure my Log Analytics workspace to collect Entra ID logs.

    

    
    Microsoft Entra
    

22. Login to Microsoft Entra using a Security Admin account.

23. In the search bar, type and then select Microsoft Entra ID.

24. From the Monitoring section, click Diagnostic settings.

    

25. Click + Add diagnostic setting.

26. Enter a name for your diagnostic setting.

27. From the Categories section, select the following:

    1. ADFSSignInLogs

    2. AuditLogs

    3. ManagedIdentitySignInLogs

    4. ServicePrincipalRiskEvents

    5. ServicePrincipalSignInLogs

    6. SignInLogs

    7. UserRiskEvents

28. From the Destination details section, select Send to Log Analytics workspace.

29. From the Subscription dropdown, select the subscription you want associated with this Diagnostic setting.

30. From the Log Analytics workspace dropdown, select the workspace from Step 2.15.

    

31. Click Save.
    

    Red Canary
    

32. Select I’ve completed configuring my Log Analytics workspace to collect Entra ID logs.

    

33. Click Next.

1. Enter the Azure Tenant ID.

   

   
   Microsoft Azure
   

2. To find the Tenant ID, log into Microsoft Azure.

3. In the search bar, type and then select Tenant Properties.

4. Copy and then paste the Tenant ID into Red Canary.

   

   
   Red Canary
   

5. Enter the Log analytics Workspace ID.

   

   
   Microsoft Azure
   

6. To find the Log analytics Workspace ID, log into Microsoft Azure.

7. In the search bar, type and then select Log Analytics workspace.

8. Click the workspace that was created in Step 2.15.

9. Click Properties.

10. Copy and then paste the Resource ID into Red Canary.

    

    
    Red Canary
    

11. Click Save.

    Note: Red Canary will now begin provisioning your resources. This could take up to 20 minutes. The integration status will show Provisioning during this time. It will update to Active once completed.

Follow the steps in Response Actions for Entra ID to enable automated playbooks, configured in Red Canary, to take action in Entra ID.

Should you need to remove the Microsoft Azure integration with Red Canary, follow these steps:

Red Canary ingests Azure Activity Logs and Defender for Cloud Alerts from Azure environments. Additionally, Red Canary integrates with Azure to scan the environment regularly to discover new subscriptions and resources.

Red Canary collects three different types of logs from Azure:

• Azure Entra ID Logs are collected for the entire tenant and your subscriptions. These logs include:

  • ADFSSignInLogs

  • AuditLogs

  • ManagedIdentitySignInLogs

  • NonInteractiveUserSignInLogs

  • ServicePrincipalRiskEvents

  • ServicePrincipalSignInLogs

  • SignInLogs

  • UserRiskEvents

• Azure Activity Logs are management and control plane data collected at the subscription level. These logs include:

  • AzureActivity

• Azure Resource Logs are logs generated by activity on a specific resource collected at the subscription level. These logs include:

  • StorageLogs

  • KeyVaultActivityLogs

In addition, Red Canary collects Azure Defender for Cloud Alerts. When Defender for Cloud is enabled on a subscription, each Azure subscription produces its own Defender for Cloud Alerts. Red Canary then collects the Defender for Cloud alerts across an Azure environment and associates those alerts with the source subscription.

For more information on how data is transferred from an Azure environment to Red Canary, see How Microsoft Azure Works with Red Canary.

Finally, Red Canary integrates with Azure to scan your environment regularly to discover new subscriptions and resources. This integration is established via access policy and enables Red Canary to read your Azure environment. This policy does not allow write access. The policies used can be found in this publicly hosted Bicep file used during integration onboarding.

Note: You may experience a potential increase in Azure costs depending on the volume of new logs exported to your Log Analytics workspace as part of the MDR for Azure integration.

• Affected Logs: Log Analytics Workspace, Log Analytics Data Export, Platform Logs (Storage Diagnostic Settings)

• For more information, see Pricing - Azure Monitor